The Agent Skills Directory

[NO_CODE]: The skill is composed entirely of Markdown and YAML configuration; no scripts (Python, Node.js, Shell) or binaries are included.
[SAFE]: A thorough review of the skill instructions and workflow revealed no evidence of prompt injection, obfuscated content, or hardcoded credentials.
[SAFE]: The skill processes repository files to generate PRDs, presenting a surface for indirect prompt injection (ingestion points: project context, PRDs, and active notes). However, the skill lacks dangerous capabilities such as command execution or network access (capability inventory: reading project files and writing markdown to the tasks/ directory), and its lack of boundary markers or sanitization is mitigated by this restricted scope.

ralph-prd